Malware Analysis Report

2024-11-30 21:55

Sample ID 230207-jjt6gsab87
Target bbe4ba566d229a405da3af72193d297f.bin
SHA256 9905dd72c5f3167a045ccc76f3d8b4d2007287842dd129034dc7bedb76a0f6b2
Tags
nanocore purecrypter downloader evasion keylogger loader persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9905dd72c5f3167a045ccc76f3d8b4d2007287842dd129034dc7bedb76a0f6b2

Threat Level: Known bad

The file bbe4ba566d229a405da3af72193d297f.bin was found to be: Known bad.

Malicious Activity Summary

nanocore purecrypter downloader evasion keylogger loader persistence spyware stealer trojan

Detect PureCrypter injector

Modifies WinLogon for persistence

NanoCore

PureCrypter

Checks computer location settings

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-07 07:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-07 07:42

Reported

2023-02-07 07:44

Platform

win7-20220812-en

Max time kernel

68s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe"

Signatures

Detect PureCrypter injector

loader
Description Indicator Process Target
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Flash Player.exe\"," C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

PureCrypter

loader downloader purecrypter

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 752 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 752 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 752 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 752 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 752 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

"C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 rcontrol4sec.ddnsgeek.com udp
FR 185.81.157.236:5080 rcontrol4sec.ddnsgeek.com tcp

Files

memory/752-54-0x0000000000870000-0x00000000009C0000-memory.dmp

memory/752-55-0x0000000004E40000-0x00000000050C2000-memory.dmp

memory/752-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

memory/608-57-0x0000000000000000-mapping.dmp

memory/608-59-0x000000006FD20000-0x00000000702CB000-memory.dmp

memory/608-60-0x000000006FD20000-0x00000000702CB000-memory.dmp

memory/608-61-0x000000006FD20000-0x00000000702CB000-memory.dmp

memory/752-62-0x00000000045A0000-0x0000000004606000-memory.dmp

memory/1488-63-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1488-64-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1488-66-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1488-67-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1488-69-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1488-70-0x000000000041E792-mapping.dmp

memory/1488-72-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1488-74-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1488-76-0x00000000003D0000-0x00000000003DA000-memory.dmp

memory/1488-77-0x00000000003E0000-0x00000000003FE000-memory.dmp

memory/1488-78-0x0000000000440000-0x000000000044A000-memory.dmp

memory/1488-79-0x00000000004B0000-0x00000000004C2000-memory.dmp

memory/1488-80-0x00000000004C0000-0x00000000004DA000-memory.dmp

memory/1488-81-0x00000000004F0000-0x00000000004FE000-memory.dmp

memory/1488-82-0x0000000000550000-0x0000000000562000-memory.dmp

memory/1488-83-0x0000000000560000-0x000000000056E000-memory.dmp

memory/1488-84-0x0000000000570000-0x000000000057C000-memory.dmp

memory/1488-85-0x00000000006A0000-0x00000000006B4000-memory.dmp

memory/1488-86-0x00000000006B0000-0x00000000006BC000-memory.dmp

memory/1488-87-0x00000000006C0000-0x00000000006D0000-memory.dmp

memory/1488-88-0x00000000006D0000-0x00000000006E4000-memory.dmp

memory/1488-89-0x00000000006F0000-0x00000000006FE000-memory.dmp

memory/1488-90-0x0000000000710000-0x000000000073E000-memory.dmp

memory/1488-91-0x0000000000850000-0x0000000000864000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-07 07:42

Reported

2023-02-07 07:44

Platform

win10v2004-20221111-en

Max time kernel

63s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Flash Player.exe\"," C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe
PID 4620 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

"C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

C:\Users\Admin\AppData\Local\Temp\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe

Network

Country Destination Domain Proto
NL 142.251.36.45:443 tcp
NL 172.217.168.202:443 tcp
NL 142.250.179.195:443 tcp
US 8.8.4.4:443 tcp
GB 216.58.208.99:443 tcp
US 8.8.8.8:53 rcontrol4sec.ddnsgeek.com udp
FR 185.81.157.236:5080 rcontrol4sec.ddnsgeek.com tcp
US 93.184.221.240:80 tcp
NL 104.80.225.205:443 tcp
NL 172.217.168.238:443 tcp
NL 142.251.36.1:443 tcp
NL 142.250.179.163:443 tcp
NL 20.50.201.200:443 tcp
US 8.8.4.4:443 tcp
NL 142.250.179.195:443 tcp

Files

memory/4620-132-0x00000000000F0000-0x0000000000240000-memory.dmp

memory/4620-133-0x0000000004FE0000-0x0000000005002000-memory.dmp

memory/3648-134-0x0000000000000000-mapping.dmp

memory/3648-135-0x0000000003350000-0x0000000003386000-memory.dmp

memory/3648-136-0x0000000005C20000-0x0000000006248000-memory.dmp

memory/3648-137-0x00000000058F0000-0x0000000005956000-memory.dmp

memory/3648-138-0x00000000062C0000-0x0000000006326000-memory.dmp

memory/3648-139-0x0000000006910000-0x000000000692E000-memory.dmp

memory/3648-140-0x0000000007F60000-0x00000000085DA000-memory.dmp

memory/3648-141-0x0000000006E00000-0x0000000006E1A000-memory.dmp

memory/3376-142-0x0000000000000000-mapping.dmp

memory/3376-143-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107.exe.log

MD5 a713c363be116d5ed1f971db6a657e4f
SHA1 90791863564c9ed38e7b4f047022dec4474060a1
SHA256 4b5c446ec8ed2a2696ba00a0890763d413006ce1ea1a7a32fda1655720aef46e
SHA512 5dc740414a6ec30908e924f3bdfae2f761a35a476ef2dda239b789575a0a3696169deb6dc84a14d5828eaa5644623f107b2c686bfa4f54a90f0688239b4b1739

memory/3376-145-0x0000000005E60000-0x0000000006404000-memory.dmp

memory/3376-146-0x00000000058B0000-0x0000000005942000-memory.dmp

memory/3376-147-0x00000000059F0000-0x0000000005A8C000-memory.dmp

memory/3376-148-0x0000000005880000-0x000000000588A000-memory.dmp